N3904027Q1002 A001 Attachment 3 OPSEC Contract Requirement.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements form, which must be attached with solicitations and awards.

The document establishes OPSEC requirements for contractors and subcontractors working at Portsmouth Naval Shipyard to protect sensitive and classified information from unauthorized disclosure. An OPSEC plan must be signed by the Prime Contractor and forwarded to the contracting officer by encrypted email or U.S. Postal Service prior to the contract's start date. The document indicates that an OPSEC Plan is NOT required for this contract based on the checked box. Contractors are responsible for avoiding inadvertent disclosure of unclassified or classified information and protecting Controlled Unclassified Information (CUI) in a manner appropriate to the nature of the information. Personnel may be exposed to U.S. Government Critical Information and Indicators (CII), which shall not be distributed to unauthorized third parties, including foreign entities or companies under Foreign Ownership, Control or Influence (FOCI), published in corporate communications, or posted on social media. Disclosure or compromise of CII may result in contract removal, termination, and criminal prosecution.

The document provides detailed examples of CII and indicators that require protection, including personally identifiable information, operation and repair schedules, equipment capabilities, asset identification, and photographs or videos taken within shipyard areas. Countermeasures include prohibiting posting of classified or sensitive information to company websites or social media, shredding all sensitive documents using approved NSA crosscut shredders, removing and returning access badges upon departure, and immediately reporting unauthorized disclosures or suspected compromises to the Activity Security Manager and Industrial Security Officer. Additional guidance on Portable Electronic Devices (PEDs) is provided, requiring coordination with sponsors regarding device use and security protocols.